CVE-2015-4734: Medium severity oracle java se 7 vulnerability

Published Oct 20, 2015

Updated

It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions.

Other sources

Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JGSS.

— MITRE

Affected Software

8 affected components

Oracle JDK=1.6.0-update101

Oracle JDK=1.7.0-update85

Oracle JDK=1.8.0-update51

Oracle JDK=1.8.0-update60

ORACLE JRE=1.6.0-update_101

ORACLE JRE=1.7.0-update_85

ORACLE JRE=1.8.0-update_51

ORACLE JRE=1.8.0-update_60

Event History

Oct 20, 2015

Data Sourced

via Red Hat·12:40 PM

DescriptionSeverityAffected Software

Oct 21, 2015

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4734?

CVE-2015-4734 is considered to have a moderate severity level as it may allow remote attackers to affect confidentiality.

How do I fix CVE-2015-4734?

To fix CVE-2015-4734, update your Oracle Java SE or Java Runtime Environment to a version that is not affected, such as the latest updates.

Which versions of Oracle Java are affected by CVE-2015-4734?

CVE-2015-4734 affects Oracle Java SE versions 6u101, 7u85, and 8u60, as well as Java SE Embedded 8u51.

What components of Oracle Java are involved in CVE-2015-4734?

The JGSS component of OpenJDK is involved in the CVE-2015-4734 vulnerability.

Can CVE-2015-4734 lead to data disclosure?

Yes, CVE-2015-4734 may lead to data disclosure by allowing attackers to exploit vulnerabilities in error exception handling.